Windows Analysis Report
SecuriteInfo.com.Trojan.Inject.3564.exe

Overview

General Information

Sample Name: SecuriteInfo.com.Trojan.Inject.3564.exe
Analysis ID: 635115
MD5: 0d6d5bef9fc4a8d2e0fc32bb4d524aaf
SHA1: 78ba54ad4ff986e5d96a35cd441de47517455ba9
SHA256: 824a49f83e2e0d1be82a9aee6ac76add4d9ff7ac3dc633e754e5dad1977a9cf9
Infos:

Detection

GuLoader, Remcos
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected Remcos RAT
Antivirus detection for URL or domain
Yara detected GuLoader
Snort IDS alert for network traffic
Hides threads from debuggers
Installs a global keyboard hook
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
C2 URLs / IPs found in malware configuration
Uses 32bit PE files
May sleep (evasive loops) to hinder dynamic analysis
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Found dropped PE file which has not been started or loaded
Contains functionality for execution timing, often used to detect debuggers
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
PE file contains strange resources
Drops PE files
Tries to load missing DLLs
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Detected TCP or UDP traffic on non-standard ports
Checks if the current process is being debugged
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality for read data from the clipboard

Classification

AV Detection
barindex
Found malware configuration
Source: 00000003.00000002.29960207912.0000000001CF0000.00000004.00000020.00020000.00000000.sdmp Malware Configuration Extractor: Remcos {"Host:Port:Password": "185.222.57.217:8780:|", "Assigned name": "Host", "Connect interval": "5", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Disable", "Install path": "AppData", "Copy file": "remcos.exe", "Startup value": "remcos", "Hide file": "Disable", "Mutex": "remcos_rurbibqnnhyclpl", "Keylog flag": "1", "Keylog path": "AppData", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screens", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio path": "AppData", "Audio folder": "audio", "Connect delay": "0", "Copy folder": "remcos", "Keylog folder": "remcos"}
Source: 00000001.00000002.25193370365.00000000032C1000.00000040.00001000.00020000.00000000.sdmp Malware Configuration Extractor: GuLoader {"Payload URL": "http://185.222.57.79/SALES/1%20FEB%202-22_jalPPiWqFb130.bin"}
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.Trojan.Inject.3564.exe Virustotal: Detection: 11% Perma Link
Yara detected Remcos RAT
Source: Yara match File source: 00000003.00000002.29960207912.0000000001CF0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Trojan.Inject.3564.exe PID: 4000, type: MEMORYSTR
Antivirus detection for URL or domain
Source: 185.222.57.217 Avira URL Cloud: Label: malware
Uses 32bit PE files
Source: SecuriteInfo.com.Trojan.Inject.3564.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Source: SecuriteInfo.com.Trojan.Inject.3564.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: mshtml.pdb source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000001.25048749211.0000000000649000.00000008.00000001.01000000.00000005.sdmp
Source: Binary string: D:\SourceCode\GC3.Overclocking\production_V4.2\Service\ServiceSDK\Release\ThrottlePlugin\ThrottlePlugin.pdb source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr
Source: Binary string: D:\SourceCode\GC3.Overclocking\production_V4.2\Service\ServiceSDK\Release\ThrottlePlugin\ThrottlePlugin.pdb00 source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr
Source: Binary string: mshtml.pdbUGP source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000001.25048749211.0000000000649000.00000008.00000001.01000000.00000005.sdmp
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 1_2_00405D74
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_0040290B FindFirstFileW, 1_2_0040290B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_0040699E FindFirstFileW,FindClose, 1_2_0040699E

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2018752 ET TROJAN Generic .bin download from Dotted Quad 192.168.11.20:49748 -> 185.222.57.79:80
Source: Traffic Snort IDS: 2829308 ETPRO TROJAN MSIL/Remcos Variant CnC Checkin 192.168.11.20:49749 -> 185.222.57.217:8780
Source: Traffic Snort IDS: 2825929 ETPRO TROJAN MSIL/Remcos RAT CnC Checkin 192.168.11.20:49749 -> 185.222.57.217:8780
Source: Traffic Snort IDS: 2825930 ETPRO TROJAN MSIL/Remcos RAT CnC Keep-Alive (Inbound) 185.222.57.217:8780 -> 192.168.11.20:49749
Source: Traffic Snort IDS: 2825931 ETPRO TROJAN MSIL/Remcos RAT CnC Keep-Alive (Outbound) 192.168.11.20:49749 -> 185.222.57.217:8780
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://185.222.57.79/SALES/1%20FEB%202-22_jalPPiWqFb130.bin
Source: Malware configuration extractor URLs: 185.222.57.217
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: ROOTLAYERNETNL ROOTLAYERNETNL
Source: Joe Sandbox View ASN Name: ROOTLAYERNETNL ROOTLAYERNETNL
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /SALES/1%20FEB%202-22_jalPPiWqFb130.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: 185.222.57.79Cache-Control: no-cache
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.11.20:49749 -> 185.222.57.217:8780
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: unknown TCP traffic detected without corresponding DNS query: 185.222.57.79
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29960026730.00000000018BF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.222.57.79/
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29960026730.00000000018BF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.222.57.79/SALES/1
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29960026730.00000000018BF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.222.57.79/SALES/1%20FEB%202-22_jalPPiWqFb130.bin
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29959603610.0000000001868000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.222.57.79/SALES/1%20FEB%202-22_jalPPiWqFb130.binY
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: user-not-tracked-symbolic.svg.1.dr String found in binary or memory: http://creativecommons.org/licenses/by-sa/4.0/
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, user-not-tracked-symbolic.svg.1.dr String found in binary or memory: http://creativecommons.org/ns#
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25187530812.000000000040A000.00000004.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, user-not-tracked-symbolic.svg.1.dr String found in binary or memory: http://creativecommons.org/ns#Attribution
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25187530812.000000000040A000.00000004.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, user-not-tracked-symbolic.svg.1.dr String found in binary or memory: http://creativecommons.org/ns#DerivativeWorks
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25187530812.000000000040A000.00000004.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, user-not-tracked-symbolic.svg.1.dr String found in binary or memory: http://creativecommons.org/ns#Distribution
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25187530812.000000000040A000.00000004.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, user-not-tracked-symbolic.svg.1.dr String found in binary or memory: http://creativecommons.org/ns#Notice
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25187530812.000000000040A000.00000004.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, user-not-tracked-symbolic.svg.1.dr String found in binary or memory: http://creativecommons.org/ns#Reproduction
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25187530812.000000000040A000.00000004.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, user-not-tracked-symbolic.svg.1.dr String found in binary or memory: http://creativecommons.org/ns#ShareAlike
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr String found in binary or memory: http://crl.globalsign.com/gsextendcodesignsha2g3.crl0
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr String found in binary or memory: http://crl.globalsign.com/root-r3.crl0b
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr String found in binary or memory: http://crl.globalsign.com/root.crl0G
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000001.25048749211.0000000000649000.00000008.00000001.01000000.00000005.sdmp String found in binary or memory: http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference.
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, MDDINGEN.exe.3.dr String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr String found in binary or memory: http://ocsp.digicert.com0O
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr String found in binary or memory: http://ocsp.globalsign.com/rootr103
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr String found in binary or memory: http://ocsp2.globalsign.com/gsextendcodesignsha2g30U
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr String found in binary or memory: http://secure.globalsign.com/cacert/gsextendcodesignsha2g3ocsp.crt0
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000001.25048749211.0000000000649000.00000008.00000001.01000000.00000005.sdmp String found in binary or memory: http://www.gopher.ftp://ftp.
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000001.25048579911.0000000000626000.00000008.00000001.01000000.00000005.sdmp String found in binary or memory: http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3O//DTD
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000001.25048337068.00000000005F2000.00000008.00000001.01000000.00000005.sdmp String found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000001.25048337068.00000000005F2000.00000008.00000001.01000000.00000005.sdmp String found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000001.25048749211.0000000000649000.00000008.00000001.01000000.00000005.sdmp String found in binary or memory: https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr String found in binary or memory: https://www.digicert.com/CPS0
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr String found in binary or memory: https://www.globalsign.com/repository/0
Source: global traffic HTTP traffic detected: GET /SALES/1%20FEB%202-22_jalPPiWqFb130.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: 185.222.57.79Cache-Control: no-cache

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Installs a global keyboard hook
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Jump to behavior
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_00405809 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, 1_2_00405809

E-Banking Fraud
barindex
Yara detected Remcos RAT
Source: Yara match File source: 00000003.00000002.29960207912.0000000001CF0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Trojan.Inject.3564.exe PID: 4000, type: MEMORYSTR
Uses 32bit PE files
Source: SecuriteInfo.com.Trojan.Inject.3564.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 1_2_00403640
Detected potential crypto function
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_00406D5F 1_2_00406D5F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_719D1BFF 1_2_719D1BFF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032CCBB5 1_2_032CCBB5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032CE1CD 1_2_032CE1CD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C533D 1_2_032C533D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C8F32 1_2_032C8F32
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C6706 1_2_032C6706
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C6772 1_2_032C6772
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C8B4C 1_2_032C8B4C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C8757 1_2_032C8757
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C67EE 1_2_032C67EE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032CEBE0 1_2_032CEBE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C5224 1_2_032C5224
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032CEE3E 1_2_032CEE3E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032CE632 1_2_032CE632
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C6662 1_2_032C6662
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C864B 1_2_032C864B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C9A93 1_2_032C9A93
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C86E7 1_2_032C86E7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032CAACE 1_2_032CAACE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C6936 1_2_032C6936
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C890D 1_2_032C890D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C5552 1_2_032C5552
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C51A5 1_2_032C51A5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C69A7 1_2_032C69A7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C5587 1_2_032C5587
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C8595 1_2_032C8595
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C8593 1_2_032C8593
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C85EE 1_2_032C85EE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C55D6 1_2_032C55D6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C503A 1_2_032C503A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C8808 1_2_032C8808
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C501D 1_2_032C501D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C5478 1_2_032C5478
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C88A2 1_2_032C88A2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C5CBF 1_2_032C5CBF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C508C 1_2_032C508C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C6888 1_2_032C6888
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C5094 1_2_032C5094
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C50F2 1_2_032C50F2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C54CF 1_2_032C54CF
Contains functionality to call native functions
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032CFF03 NtResumeThread, 1_2_032CFF03
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032CFA59 NtProtectVirtualMemory, 1_2_032CFA59
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032CE1CD NtAllocateVirtualMemory, 1_2_032CE1CD
Sample file is different than original file name gathered from version info
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameThrottlePlugin.dllL vs SecuriteInfo.com.Trojan.Inject.3564.exe
PE file contains strange resources
Source: SecuriteInfo.com.Trojan.Inject.3564.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Tries to load missing DLLs
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Section loaded: edgegdi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Section loaded: edgegdi.dll Jump to behavior
Source: SecuriteInfo.com.Trojan.Inject.3564.exe Virustotal: Detection: 11%
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe File read: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Jump to behavior
Source: SecuriteInfo.com.Trojan.Inject.3564.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 1_2_00403640
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe File created: C:\Users\user\AppData\Roaming\remcos Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe File created: C:\Users\user\AppData\Local\Temp\nsb8CF.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@3/13@0/2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_004021AA CoCreateInstance, 1_2_004021AA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_00404AB5 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 1_2_00404AB5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Mutant created: \Sessions\1\BaseNamedObjects\remcos_rurbibqnnhyclpl
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe File written: C:\Users\user\AppData\Local\Temp\HERMAPHRODEITY.ini Jump to behavior
Source: SecuriteInfo.com.Trojan.Inject.3564.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: mshtml.pdb source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000001.25048749211.0000000000649000.00000008.00000001.01000000.00000005.sdmp
Source: Binary string: D:\SourceCode\GC3.Overclocking\production_V4.2\Service\ServiceSDK\Release\ThrottlePlugin\ThrottlePlugin.pdb source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr
Source: Binary string: D:\SourceCode\GC3.Overclocking\production_V4.2\Service\ServiceSDK\Release\ThrottlePlugin\ThrottlePlugin.pdb00 source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25190200051.000000000295C000.00000004.00000800.00020000.00000000.sdmp, ThrottlePlugin.dll.1.dr
Source: Binary string: mshtml.pdbUGP source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000001.25048749211.0000000000649000.00000008.00000001.01000000.00000005.sdmp

Data Obfuscation
barindex
Yara detected GuLoader
Source: Yara match File source: 00000001.00000002.25193370365.00000000032C1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.25046406894.0000000001660000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_719D30C0 push eax; ret 1_2_719D30EE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C3A02 push ebp; retf 1_2_032C3C98
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C8F18 push 00000038h; retf 1_2_032C8F2D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C974A push es; retf 1_2_032C9822
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C424A push dword ptr [esi-4Dh]; iretd 1_2_032C4326
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C729B push ds; iretd 1_2_032C729F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C42EA push dword ptr [esi-4Dh]; iretd 1_2_032C4326
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C4126 push dword ptr [esi-4Dh]; iretd 1_2_032C4326
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C419B push dword ptr [esi-4Dh]; iretd 1_2_032C4326
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C99D3 push edi; retf 1_2_032C9A11
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C3C86 push ebp; retf 1_2_032C3C98
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C40FD push dword ptr [esi-4Dh]; iretd 1_2_032C4326
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C34C7 push ss; iretd 1_2_032C34C9
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_719D1BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, 1_2_719D1BFF
Drops PE files
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe File created: C:\Users\user\AppData\Local\Temp\nsw99C.tmp\System.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe File created: C:\Users\user\AppData\Local\Temp\ThrottlePlugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Vattersottig9 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Vattersottig9 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Vattersottig9 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Vattersottig9 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Tries to detect Any.run
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe File opened: C:\Program Files\Qemu-ga\qemu-ga.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe File opened: C:\Program Files\qga\qga.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe File opened: C:\Program Files\Qemu-ga\qemu-ga.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe File opened: C:\Program Files\qga\qga.exe Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25193747367.00000000033B1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: NTDLLUSER32KERNEL32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEPSAPI.DLLMSI.DLLPUBLISHERWININET.DLLMOZILLA/5.0 (WINDOWS NT 10.0; WOW64; TRIDENT/7.0; RV:11.0) LIKE GECKOSHELL32ADVAPI32TEMP=WINDIR=\SYSWOW64\MSHTML.DLL
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25193747367.00000000033B1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe TID: 7068 Thread sleep count: 3070 > 30 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe TID: 7068 Thread sleep time: -30700000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Last function: Thread delayed
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\ThrottlePlugin.dll Jump to dropped file
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C6424 rdtsc 1_2_032C6424
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Window / User API: threadDelayed 3070 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Window / User API: foregroundWindowGot 732 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_00405D74 CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 1_2_00405D74
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_0040290B FindFirstFileW, 1_2_0040290B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_0040699E FindFirstFileW,FindClose, 1_2_0040699E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe API call chain: ExitProcess graph end node
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25194257929.0000000004F49000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Guest Shutdown Service
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25194257929.0000000004F49000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Remote Desktop Virtualization Service
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25194257929.0000000004F49000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmicshutdown
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25194257929.0000000004F49000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Volume Shadow Copy Requestor
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25194257929.0000000004F49000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V PowerShell Direct Service
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25194257929.0000000004F49000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Time Synchronization Service
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25194257929.0000000004F49000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmicvss
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29960096918.00000000018CE000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29959850772.0000000001899000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29960096918.00000000018CE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWkKvA
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25193747367.00000000033B1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25194257929.0000000004F49000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Data Exchange Service
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25194257929.0000000004F49000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Heartbeat Service
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25194257929.0000000004F49000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V Guest Service Interface
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25194257929.0000000004F49000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmicheartbeat
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000001.00000002.25193747367.00000000033B1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: ntdlluser32kernel32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exepsapi.dllMsi.dllPublisherwininet.dllMozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Geckoshell32advapi32TEMP=windir=\syswow64\mshtml.dll

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Thread information set: HideFromDebugger Jump to behavior
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_719D1BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, 1_2_719D1BFF
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C6424 rdtsc 1_2_032C6424
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C8B7A mov eax, dword ptr fs:[00000030h] 1_2_032C8B7A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C8B4C mov eax, dword ptr fs:[00000030h] 1_2_032C8B4C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032CEBE0 mov eax, dword ptr fs:[00000030h] 1_2_032CEBE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032CB229 mov eax, dword ptr fs:[00000030h] 1_2_032CB229
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032CEE3E mov eax, dword ptr fs:[00000030h] 1_2_032CEE3E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032CDE50 mov eax, dword ptr fs:[00000030h] 1_2_032CDE50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C8D2A mov ebx, dword ptr fs:[00000030h] 1_2_032C8D2A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C8D19 mov ebx, dword ptr fs:[00000030h] 1_2_032C8D19
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C8D19 mov eax, dword ptr fs:[00000030h] 1_2_032C8D19
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C8595 mov eax, dword ptr fs:[00000030h] 1_2_032C8595
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C8593 mov eax, dword ptr fs:[00000030h] 1_2_032C8593
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C8C0A mov eax, dword ptr fs:[00000030h] 1_2_032C8C0A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C8CBE mov eax, dword ptr fs:[00000030h] 1_2_032C8CBE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032C508C mov eax, dword ptr fs:[00000030h] 1_2_032C508C
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_032CC478 LdrInitializeThunk, 1_2_032CC478
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe" Jump to behavior
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29960241584.0000000001CF6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: d|0|cmd|Program Manager
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29960241584.0000000001CF6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program Manager
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29960241584.0000000001CF6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program Managerer
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29960241584.0000000001CF6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: d|0|cmd|Program Manager|cmd|
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29960241584.0000000001CF6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Program Manageranager
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29984241513.000000001D52D000.00000004.00000010.00020000.00000000.sdmp, logs.dat.3.dr Binary or memory string: [ Program Manager ]
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29960241584.0000000001CF6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: art]Bpong|cmd|0|cmd|Program Manager|cmd|107|cmd|82453234
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29960241584.0000000001CF6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: d|0|cmd|Program Manager|cmd|109|cmd|$+vx$+vx
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29960241584.0000000001CF6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: d|0|cmd|Program Manager|cmd|121|cmd|87943281
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29960241584.0000000001CF6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: art]Bpong|cmd|0|cmd|Program Manager|cmd|109|cmd|91603265C,,
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29960241584.0000000001CF6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: d|0|cmd|Program Manager|cmd|109
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29960241584.0000000001CF6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: art]Bpong|cmd|0|cmd|Program Manager|cmd|121|cmd|87943281C
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29960241584.0000000001CF6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: d|0|cmd|Program Manager|cmd|107|cmd|82453234ember:Oct:October:Nov:November:Dec:DYY
Source: SecuriteInfo.com.Trojan.Inject.3564.exe, 00000003.00000002.29960241584.0000000001CF6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: d|0|cmd|Program Manager|cmd|109|cmd|91603265
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Inject.3564.exe Code function: 1_2_00403640 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 1_2_00403640

Stealing of Sensitive Information
barindex
Yara detected Remcos RAT
Source: Yara match File source: 00000003.00000002.29960207912.0000000001CF0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Trojan.Inject.3564.exe PID: 4000, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected Remcos RAT
Source: Yara match File source: 00000003.00000002.29960207912.0000000001CF0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Trojan.Inject.3564.exe PID: 4000, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 635115 Sample: SecuriteInfo.com.Trojan.Inj... Startdate: 27/05/2022 Architecture: WINDOWS Score: 100 22 Snort IDS alert for network traffic 2->22 24 Found malware configuration 2->24 26 Antivirus detection for URL or domain 2->26 28 5 other signatures 2->28 6 SecuriteInfo.com.Trojan.Inject.3564.exe 3 28 2->6         started        process3 file4 14 C:\Users\user\AppData\Local\...\System.dll, PE32 6->14 dropped 16 C:\Users\user\AppData\...\ThrottlePlugin.dll, PE32+ 6->16 dropped 30 Tries to detect Any.run 6->30 32 Hides threads from debuggers 6->32 10 SecuriteInfo.com.Trojan.Inject.3564.exe 2 10 6->10         started        signatures5 process6 dnsIp7 18 185.222.57.217, 49749, 8780 ROOTLAYERNETNL Netherlands 10->18 20 185.222.57.79, 49748, 80 ROOTLAYERNETNL Netherlands 10->20 34 Tries to detect Any.run 10->34 36 Hides threads from debuggers 10->36 38 Installs a global keyboard hook 10->38 signatures8
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.222.57.217
 unknown Netherlands
51447 ROOTLAYERNETNL true
185.222.57.79
 unknown Netherlands
51447 ROOTLAYERNETNL true

Contacted URLs

Name Malicious Antivirus Detection Reputation
185.222.57.217 true
  • Avira URL Cloud: malware
 unknown
http://185.222.57.79/SALES/1%20FEB%202-22_jalPPiWqFb130.bin true
  • Avira URL Cloud: safe
 unknown